diff --git a/.github/workflows/org-quality-gate.yml b/.github/workflows/org-quality-gate.yml
index 45e53e9..0942433 100644
--- a/.github/workflows/org-quality-gate.yml
+++ b/.github/workflows/org-quality-gate.yml
@@ -15,8 +15,10 @@ permissions:
 jobs:
   quality-gate:
     name: quality-gate
-    uses: agiletec-inc/github-actions/.github/workflows/quality-gate.yml@ce8723bb24baea6546a3b77e1327f94fcc1c4064
+    uses: agiletec-inc/github-actions/.github/workflows/quality-gate.yml@1941747f4149058807fc3e10d69412508027b9bd
     with:
-      source-ref: ce8723bb24baea6546a3b77e1327f94fcc1c4064
-      linux-runs-on: ${{ github.repository == 'agiletec-inc/agiletec' && 'agiletec-ci-runner' || github.event.repository.private && 'org-shared-ci-light' || 'ubuntu-latest' }}
+      source-ref: 1941747f4149058807fc3e10d69412508027b9bd
+      # Every private repository uses the isolated organization-required pool.
+      # Repository-specific routing would create an exception in the org gate.
+      linux-runs-on: ${{ github.event.repository.private && 'org-required-ci' || 'ubuntu-latest' }}
       swift-runs-on: macos-latest
diff --git a/tests/test_workflow_wiring.py b/tests/test_workflow_wiring.py
index 72fe5cc..561461e 100644
--- a/tests/test_workflow_wiring.py
+++ b/tests/test_workflow_wiring.py
@@ -48,11 +48,11 @@ def test_org_caller_grants_read_only_checks_and_actions_access(self) -> None:
         self.assertRegex(source, r"(?m)^\s*actions:\s*read\s*$")
         self.assertRegex(source, r"(?m)^\s*checks:\s*read\s*$")
 
-    def test_agiletec_uses_dedicated_fast_runner_and_other_private_repos_use_shared_light(self) -> None:
+    def test_private_repositories_use_the_organization_required_runner(self) -> None:
         source = ORG_CALLER.read_text()
-        self.assertIn("org-shared-ci-light", source)
-        self.assertIn("github.repository == 'agiletec-inc/agiletec'", source)
-        self.assertIn("'agiletec-ci-runner'", source)
+        self.assertIn("'org-required-ci'", source)
+        self.assertNotIn("github.repository", source)
+        self.assertNotIn("agiletec-ci-runner", source)
 
     def test_ci_discovers_all_contract_test_modules(self) -> None:
         source = CI.read_text()